@piagent/platform 1.45.0 → 1.46.1

package/packages/piagent-core/managed/session.mjs

@@ -8,7 +8,7 @@ import { ensureSearchTools, trustSystemCertificates } from './toolchain.mjs';
 import { inlineExtensions, managedResourceLoader, projectInstructions } from './resource-loader.mjs';
 import { fetchPublicPage, fetchLimits } from './web-fetch.mjs'; import { guardFetch } from './fetch-guard.mjs'; import { UNTRUSTED_RULE } from './untrusted.mjs';
 import { searchForRole } from './web-search.mjs';
-import { shareGrant, releaseGrant } from './grant-share.mjs';
+import { shareGrant, releaseGrant, slotArgs } from './grant-share.mjs';
 import { managedThinkingLevels, nearestLevel } from './capabilities.mjs';
 import { nativeManagedModel, isVendor, piProvider, studioAPI, studioPath } from './native-catalog.mjs';
 import { fetchOriginTool } from './repository-operation.mjs';
@@ -24,7 +24,7 @@ import { readPatchDigest, readPatchSnapshot, readChangedFiles, readHead } from '
 import { memberTurn } from './continuation.mjs';
 import { workflowPolicy, repositoryChecks, sessionPlanTool, currentPlan, workflowPrompt, RunProcess, completionGate, pendingBaseline, pendingPaths, pendingHead, processEditTools } from './workflow.mjs';
 import { workflowContextTool, workflowContextExtension } from './workflow-context.mjs';
-import { beforeDelegate } from './objections.mjs';
+import { beforeDelegate, resolveTool } from './objections.mjs'; import { fanOut } from './copies.mjs';
 import { HELPER_CALLS, HELPER_ROLES, helperRoles, helperPrompt, webPrompt, delegateDescription, mainWebLookups, limitedWebTools } from './helper-roles.mjs'; import { delegateParameters, delegateArgs, SPEC_PROMPT } from './helper-settlement.mjs';
 import { loadAgentResources } from './agent-skills.mjs';
 import { loadPiagentThemes } from '../runtime/terminal/terminal-style.mjs';
@@ -75,8 +75,9 @@ async function patiently(ask, times) {
     catch (error) { if (attempt >= times || !BUSY.test(String(error?.message))) throw error; await sleep(1500 * attempt); }
   }
 }
-function verifyGrant(grant, manifest, role) {
-  if (!grant || !sameAuthority(grant, manifest.authority) || grant.role !== role || !Number.isSafeInteger(grant.fence) || grant.fence < 1
+function verifyGrant(grant, manifest, key) {
+  const { role, slot = 1 } = slotArgs(key); // a helper beside another of its role: role#slot (grant-share.mjs)
+  if (!grant || !sameAuthority(grant, manifest.authority) || grant.role !== role || (grant.slot ?? 1) !== slot || !Number.isSafeInteger(grant.fence) || grant.fence < 1
     || !/^as_run_[a-f0-9-]{36}_[\w-]{43}$/.test(grant.token) || !(['claude', 'codex'].includes(grant.provider) || isVendor(grant.provider))
     || !manifest.models.some(m => m.id === grant.model_id && m.owned_by === grant.provider && m.provider_model_id === grant.provider_model_id)) throw Error('managed-grant-invalid');
 }
@@ -128,7 +129,7 @@ export class ManagedSession {
     if (roles.length) customTools.push({ name: 'delegate', label: 'Subagent', description: delegateDescription(roles) + SPEC_PROMPT,
       parameters: delegateParameters(), // the brief and its structured fields (helper-settlement.mjs)
       execute: (_id, args, signal) => self.delegate(delegateArgs(self, args), signal) });
-    customTools.push(sessionPlanTool(self));
+    customTools.push(sessionPlanTool(self), ...(roles.length ? [resolveTool(self)] : [])); // the objection ledger's decisions (ledger.mjs)
     // The member decides what the request leaves open: numbered options, or their own words.
     customTools.push(workflowContextTool(() => self.session.sessionManager));
     customTools.push(askTool(self), ...memoryToolsFor(self, agentDir)); // team memory's tools, once Studio answered memory here (memory.mjs)
@@ -459,20 +460,19 @@ export class ManagedSession {
     this.review = { ...this.review, stale: true };
     this.session.sessionManager.appendCustomEntry('agent-watch-review', this.review);
     await this.session.sendCustomMessage({ customType: 'agent-watch-review-status', display: true,
-      content: 'Review is stale: code changed after review. Obtain a new review for the current patch.', details: this.review }, { triggerTurn: false });
+      content: 'Review is stale: code changed after review. Ask for another review only after fixing blocking findings; under a required review the harness reviews the final patch.', details: this.review }, { triggerTurn: false });
   }
   // `harness`: the completion gate asks, not the main agent (its brief, its turn).
-  async delegate({ role, task, title, since }, signal, { harness = false } = {}) {
+  async delegate({ role, task, title, since, ...more }, signal, { harness = false } = {}) {
     if (!this.grant || !HELPER_ROLES.includes(role) || typeof task !== 'string' || !task.trim() || task.length > 12000 || this.helpers.has(role)) throw Error('managed-helper-unavailable');
     const enabled = helperRoles(this.manifest);
     if (!enabled.includes(role)) throw Error(`managed-helper-not-configured: the company Harness has no ${role} subagent${enabled.length ? `; use ${enabled.join(', ')}` : ''}.`);
-    // Studio gives a run each helper role once. Say so at once instead of
-    // letting the main agent retry a call that cannot succeed.
     // Studio lets each helper role run HELPER_CALLS times per run (one user
-    // message). Say so at once instead of asking for a grant it refuses.
-    if ((this.helperCalls.get(role) ?? 0) >= HELPER_CALLS) throw Error(`managed-helper-limit: the ${role} subagent already ran ${HELPER_CALLS} times for this user message. Go on with what it returned, or use it again after the next user message.`);
-    beforeDelegate(this.run, role, harness);
-    const job = this.runHelper(role, task, signal, harness, title, role === 'review' && typeof since === 'string' && since.trim() ? since.trim() : null); this.helpers.set(role, job); this.publishHelpers();
+    // message), each helper the member asked for counted (copies.mjs). Say so at once.
+    const fan = fanOut(this.session?.sessionManager, role, more, harness);
+    if ((this.helperCalls.get(role) ?? 0) + (fan?.n ?? 1) > HELPER_CALLS) throw Error(`managed-helper-limit: the ${role} subagent already ran ${HELPER_CALLS} times for this user message. Go on with what it returned, or use it again after the next user message.`);
+    beforeDelegate(this.run, role, harness, { since, review: this.review, changed: (this.ownPaths?.size ?? 0) > 0, asked: !!fan });
+    const job = this.runHelper(role, task, signal, harness, title, role === 'review' && typeof since === 'string' && since.trim() ? since.trim() : null, fan); this.helpers.set(role, job); this.publishHelpers();
     // While a helper works (a verify running a long suite) the main agent is
     // quiet: a beat each minute tells the dashboard's watchdog, which stops a
     // turn after 15 minutes without an event, that the turn is working.
@@ -490,7 +490,7 @@ export class ManagedSession {
   notify(event) {
     for (const listener of [...this.listeners]) { try { listener(event); } catch { /* a listener's failure is its own */ } }
   }
-  runHelper(role, task, signal, harness, title, since = null) { return runHelper(this, role, task, signal, harness, { verifyGrant, patiently, title: typeof title === 'string' ? title : '', since }); }
+  runHelper(role, task, signal, harness, title, since = null, fan = null) { return runHelper(this, role, task, signal, harness, { verifyGrant, patiently, title: typeof title === 'string' ? title : '', since, fan }); }
   async dispose() {
     if (this.disposed) return;
     this.disposed = true;

package/packages/piagent-core/managed/toolchain.mjs

@@ -74,13 +74,17 @@ export function searchToolPath(name, userHome = os.homedir()) {
   return null;
 }
 export async function ensureSearchTools(sdkRoot, userHome = os.homedir(), timeoutMs = 60_000) {
-  const missing = ['rg', 'fd'].filter(name => !searchToolPath(name, userHome));
-  if (!missing.length) return;
   let manager;
   try { manager = await import(pathToFileURL(path.join(sdkRoot, 'dist/utils/tools-manager.js')).href); } catch { return; }
+  // The company terminal looks fd up the way Pi does (its bin folder, then a
+  // PATH of /usr/bin:/bin) and, offline, never downloads it: without fd there
+  // @ file completion shows nothing, even with fd under /opt/homebrew/bin.
+  const missing = ['rg', 'fd'].filter(name => !searchToolPath(name, userHome) || !manager.getToolPath?.(name));
+  if (!missing.length) return;
   await Promise.all(missing.map(async name => {
     try {
-      const found = await Promise.race([manager.ensureTool(name, true), new Promise(resolve => setTimeout(resolve, timeoutMs).unref())]);
+      // Pi 1.3 takes a status callback here; the former `silent` flag (true) made it throw before downloading.
+      const found = await Promise.race([manager.ensureTool(name), new Promise(resolve => setTimeout(resolve, timeoutMs).unref())]);
       if (typeof found === 'string' && path.isAbsolute(found) && executable(found)) downloaded.set(name, found);
     } catch { /* grep/find fall back to the built-in search */ }
   }));

package/packages/piagent-core/managed/workflow.mjs

@@ -6,6 +6,7 @@ import { TsDiagnostics } from './ts-diagnostics.mjs';
 import { checkpointsOf } from './checkpoints.mjs';
 import { discoverDeliveryContext } from './delivery-context.mjs';
 import { LANE_LIMITS, patchStats, changeLane, lanePolicy } from './risk-lanes.mjs';
+import { briefCounts, decisionsText, ledgerGuard, ledgerOf, ledgerWords, reviewFocus, saveLedger, setStatus, settleLedger } from './ledger.mjs';
 
 // The process layer of the company harness: a plan for multi-step work, the
 // repository's checks after a code change, an independent review of the patch.
@@ -149,8 +150,10 @@ export function workflowPrompt(policy, checks) {
     const list = checks.commands.length ? `${checks.commands.map(c => '`' + c + '`').join(', ')}${checks.source === 'detected' ? ' (detected; the repository declares none in AGENTS.md "## Checks")' : ''}` : 'none declared: choose the tests, type check or build that cover the change';
     lines.push(`- Verify: after changing code, run the repository checks that cover the change and fix failures before you finish. Repository checks: ${list}.${policy.verify === 'require' ? ' The turn does not end until a check has passed on the final code.' : ''}`);
   }
-  if (policy.review !== 'off') lines.push(policy.review === 'require' ? '- Review: the harness reviews the final patch with an independent reviewer; blocking findings come back to you to fix, or to answer when a finding is wrong: the reviewer then judges your answer, and a disagreement that remains goes to the member.'
-    : '- Review: before you finish a code change, ask the review helper (delegate role "review") to review the patch, then fix blocking findings.');
+  // What each severity asks: blocking is fixed or argued, major decided, minor only listed.
+  const severities = ' Blocking findings: fix them, or reject one with resolve_objection and the reviewer judges your reason; a disagreement that remains goes to the member. Major findings: fix them or reject them with resolve_objection; no new review follows. Minor findings are listed for the member and need nothing.';
+  if (policy.review !== 'off') lines.push(policy.review === 'require' ? `- Review: when you finish, the harness reviews the final patch with an independent reviewer, and after a fix only what you changed; do not ask for a review yourself.${severities}`
+    : `- Review: when your code change is finished, ask the review helper (delegate role "review") once; ask again only after fixing blocking findings.${severities}`);
   if (policy.lanes && (policy.verify !== 'off' || policy.review !== 'off')) {
     const L = LANE_LIMITS;
     lines.push(`- Size: the process follows the size of your change. A small change (at most ${L.tinyFiles} files and ${L.tinyLines} changed lines, no migration, auth, security, CI, dependency or AGENTS.md file) ends after its checks, without a review: do not ask for one. A risky change (a complex request, one of those files, more than ${L.riskyFiles} files or ${L.riskyLines} lines) must pass the checks${policy.review !== 'off' ? ' and the harness review' : ''} even where they are only suggested.`);
@@ -242,11 +245,12 @@ export class RunProcess {
     Object.assign(this, { policy, request: String(request ?? ''), complex, checks, startDigest: null, mutations: 0, lastCheck: null, checksRun: 0, checksFailed: 0,
       reviews: 0, blocking: 0, blockingOpen: 0, fixLoops: 0, planUpdated: false, planRefusals: new Set(), planSkipped: false, unplannedChange: false,
       unknownTools: 0, changed: false, verified: false, docsOnly: false, approvalDeclined: false, reviewed: false, reviewUnavailable: false, outcome: null, legacyOutcome: null,
-      // Helper objections to a brief, disagreements handed to the member, the
-      // claims verify marked failed, and where the harness last sent the
-      // agent back (to read its answer and see whether the code moved).
-      objections: [], disputes: [], verifyFails: [], claimsAsked: false, claimsAt: null, claimsRechecked: false, claimsDone: false,
-      sentAt: null, sentDigest: null, rejudged: false, reviewSettled: false, objectionsAsked: false,
+      // The objection ledger (ledger.mjs), disagreements handed to the
+      // member, the claims verify marked failed, the reviews the main agent
+      // asked for, and where the harness last sent the agent back (to read
+      // its answer and see whether the code moved).
+      ledger: [], disputes: [], verifyFails: [], claimsAsked: false, claimsAt: null, claimsRechecked: false, claimsDone: false, mainReviews: 0, minorFindings: 0,
+      sentAt: null, sentDigest: null, rejudged: false, reviewSettled: false, decideAsked: false,
       // The patch's risk lane (workflow.lanes) and the main agent's own web lookups.
       lane: null, laneStats: null, laneDigest: null, webLookups: 0 });
   }
@@ -295,7 +299,7 @@ export class RunProcess {
       verified: this.verified, reviews: count(this.reviews), reviewed: this.reviewed, blocking: count(this.blocking), blocking_open: Math.min(this.blockingOpen, this.blocking, 1000),
       fix_loops: this.fixLoops, outcome: (version === 3 ? this.outcome : this.legacyOutcome) ?? fallback,
       ...(version >= 2 ? { plan_skipped: this.planSkipped, unknown_tools: count(this.unknownTools) } : {}),
-      ...(version === 3 ? { objections: count(this.objections.length), objections_answered: count(this.objections.filter(o => o.answered && !o.disputed).length), disputes: count(this.disputes.length) } : {}) };
+      ...(version === 3 ? { objections: count(briefCounts(this).objections), objections_answered: count(briefCounts(this).answered), disputes: count(this.disputes.length) } : {}) };
   }
 }
 
@@ -355,15 +359,18 @@ export async function completionGate(managed, run, signal) {
       }
       if (policy.review === 'require' && !fresh && !run.reviewSettled) {
         // After a round of findings the reviewer also reads the agent's answer to them.
-        const answer = run.sentAt !== null ? answerSince(run.sentAt) : '';
-        const brief = `Review the current patch against the member's request.\n\nChecks: ${run.verified ? 'a repository check passed on this code' : 'no check has passed on this code'}.${answer ? `\n\nThe main agent's answer to your previous blocking findings (the code changed after it):\n${answer}` : ''}`;
+        const answer = run.sentAt !== null ? answerSince(run.sentAt) + decisionsText(run, 'review') : '';
+        // After a fix the reviewer checks its blocking findings and the files changed since.
+        const focus = run.sentAt !== null ? await reviewFocus(managed) : null, previous = (review?.findings ?? []).filter(f => f.severity === 'blocking').map((f, i) => `${i + 1}. ${findingText(f)}`).join('\n');
+        const brief = `Review the current patch against the member's request.\n\nChecks: ${run.verified ? 'a repository check passed on this code' : 'no check has passed on this code'}.${answer ? `\n\nThe main agent's answer to your previous blocking findings (the code changed after it):\n${answer}` : ''}${focus ? `\n\nSince your last review only these files changed: ${focus.files.join(', ')}. Judge whether each previous blocking finding is fixed (repeat it when it is not) and review the changes in these files; the rest of the patch was reviewed and has not changed.${previous ? `\nYour previous blocking findings:\n${previous}` : ''}` : ''}`;
+        managed.reviewFocus = focus;
         try { await managed.delegate({ role: 'review', task: brief }, signal, { harness: true }); }
         catch (error) {
           run.reviewUnavailable = !stopped(); run.reviewUnavailableReason = reviewUnavailableReason(error?.message); interrupted = stopped();
           // Why the review could not run, as a code only (the report says "failed").
           if (run.reviewUnavailable) try { session.sessionManager.appendCustomEntry('agent-watch-failure-detail', { role: 'review', code: failureCode(error?.message) }); } catch { /* the report still says it */ }
           break;
-        }
+        } finally { managed.reviewFocus = null; }
         continue;
       }
       if (policy.review === 'require' && fresh && (review.blocking ?? 0) > 0 && !run.reviewSettled) {
@@ -373,7 +380,7 @@ export async function completionGate(managed, run, signal) {
           // reviewer reads that answer once and judges its findings again.
           run.rejudged = true;
           await note('Harness: the main agent answered the review instead of changing the code; the reviewer judges its answer.', { phase: 'rejudge', role: 'review' });
-          const brief = `Judge your previous blocking findings on this patch again. The main agent answered them without changing the code:\n${answerSince(run.sentAt) || '(no answer)'}\n\nYour previous blocking findings:\n${list}\n\nKeep a finding as blocking when the answer does not hold against the code; leave it out when the answer is right.`;
+          const brief = `Judge your previous blocking findings on this patch again. The main agent answered them without changing the code:\n${answerSince(run.sentAt) || '(no answer)'}${decisionsText(run, 'review')}\n\nYour previous blocking findings:\n${list}\n\nKeep a finding as blocking when the answer does not hold against the code; leave it out when the answer is right.`;
           try { await managed.delegate({ role: 'review', task: brief }, signal, { harness: true }); }
           catch { if (stopped()) { interrupted = true; break; } run.reviewSettled = true; }
           continue;
@@ -381,11 +388,12 @@ export async function completionGate(managed, run, signal) {
         if (run.sentDigest === digest) {
           // It heard the answer and kept its findings: the member decides.
           run.reviewSettled = true; run.disputes.push({ source: 'review' });
+          for (const item of ledgerOf(run)) if (item.source === 'review' && item.kind === 'blocking' && ['open', 'rejected'].includes(item.status)) setStatus(item, 'disputed');
           await note(`Harness: the main agent and the review subagent still disagree after two rounds; the member decides.\n${list}`, { phase: 'dispute', role: 'review', findings: blocking.slice(0, 10) });
         } else if (run.fixLoops >= policy.maxFixLoops) run.reviewSettled = true;
         else {
           run.fixLoops += 1; run.sentDigest = digest; run.sentAt = session.messages.length;
-          await send(`Harness review of the current patch found ${blocking.length} blocking issue(s):\n${list}\nFix them, or explain why an issue is not real: an answer without a code change goes back to the reviewer, who judges it. The patch is reviewed again after your change.`,
+          await send(`Harness review of the current patch found ${blocking.length} blocking issue(s):\n${list}\nFix them, or reject one with resolve_objection (what you checked and why): a rejection without a code change goes back to the reviewer, who judges it. After your fix the reviewer checks these findings and the files you changed, not the whole patch again.`,
             { phase: 'review', loop: run.fixLoops, maxLoops: policy.maxFixLoops, findings: blocking.slice(0, 10) });
           continue;
         }
@@ -398,30 +406,25 @@ export async function completionGate(managed, run, signal) {
       const fails = run.verifyFails, list = fails.map((v, i) => `${i + 1}. ${v.claim}${v.evidence ? `\n   Evidence: ${v.evidence}` : ''}`).join('\n'), claims = fails.slice(0, 10).map(v => ({ claim: v.claim }));
       if (!run.claimsAsked) {
         run.claimsAsked = true; run.claimsAt = session.messages.length;
-        await send(`Harness: the verify subagent marked ${fails.length} claim(s) as failed:\n${list}\nFix the cause, or explain why a verdict is wrong. The verify subagent then checks these claims again with your answer.`, { phase: 'claims', claims });
+        await send(`Harness: the verify subagent marked ${fails.length} claim(s) as failed:\n${list}\nFix the cause, or reject a verdict with resolve_objection (what you checked and why). The verify subagent then checks these claims again with your answer.`, { phase: 'claims', claims });
         continue;
       }
       if (!run.claimsRechecked) {
         run.claimsRechecked = true;
         await note("Harness: the verify subagent checks the failed claims again with the main agent's answer.", { phase: 'rejudge', role: 'verify' });
-        try { await managed.delegate({ role: 'verify', task: `Check these claims again on the current code; they were marked failed before:\n${list}\n\nThe main agent's answer:\n${answerSince(run.claimsAt) || '(no answer)'}\n\nA claim passes only on evidence you see yourself. It stays failed when it does not hold and the result the member asked for depends on it. When the answer shows the claim is not part of what the member asked and the result does not depend on it, mark it unverifiable and say why.` }, signal, { harness: true }); }
+        try { await managed.delegate({ role: 'verify', task: `Check these claims again on the current code; they were marked failed before:\n${list}\n\nThe main agent's answer:\n${answerSince(run.claimsAt) || '(no answer)'}${decisionsText(run, 'verify')}\n\nA claim passes only on evidence you see yourself. It stays failed when it does not hold and the result the member asked for depends on it. When the answer shows the claim is not part of what the member asked and the result does not depend on it, mark it unverifiable and say why.` }, signal, { harness: true }); }
         catch { if (stopped()) { interrupted = run.changed; break; } }
         continue;
       }
       run.claimsDone = true; run.disputes.push({ source: 'verify' });
+      for (const item of ledgerOf(run)) if (item.source === 'verify' && ['open', 'accepted', 'rejected'].includes(item.status)) setStatus(item, 'disputed');
       await note(`Harness: the main agent and the verify subagent still disagree after two rounds; the member decides.\n${list}`, { phase: 'dispute', role: 'verify', claims });
     }
     // Plan "require": a checklist left with open steps is the next round's
     // (continuation.mjs), after this run's checks and review.
-    // An objection no corrected brief followed is answered to the member, once.
-    const open = run.objections.filter(o => !o.answered && !o.disputed);
-    if (open.length && !run.objectionsAsked) {
-      run.objectionsAsked = true;
-      await send(`Harness: ${open.length} objection(s) to a brief got no corrected brief:\n${open.map(o => `- ${o.role} subagent: ${o.issues.map(i => `[${i.kind}] ${i.detail}`).join('; ')}`).join('\n')}\nIn your answer to the member, say in one or two sentences what you decided about ${open.length === 1 ? 'it' : 'each'} and why.`,
-        { phase: 'answer', role: open[0].role, issues: open.flatMap(o => o.issues).slice(0, 10) });
-      for (const o of open) o.answered = true;
-      continue;
-    }
+    // A rejected premise objection goes back to its helper; then what the
+    // main agent never decided is asked once (ledger.mjs).
+    if (await settleLedger(managed, run, { note, send, signal })) continue;
     break;
   }
   // However the code was changed, a complex task under plan "require" that
@@ -434,14 +437,15 @@ export async function completionGate(managed, run, signal) {
   session.sessionManager.appendCustomEntry(BASELINE_ENTRY, { digest: settled ? digest : run.startDigest, settled, outcome: run.outcome, ...(managed.base ? { head: managed.base } : {}),
     ...(settled ? {} : { paths: [...(managed.ownPaths ?? [])].slice(0, 2000) }) });
   if (run.checkpoint) await checkpointsOf(managed).finish(run);
-  if (!run.changed && !run.disputes.length) return;
+  saveLedger(managed);
+  if (!run.changed && !run.disputes.length && !ledgerOf(run).length) return;
   const finalPlan = currentPlan(session.sessionManager), planOpen = run.planUpdated ? finalPlan?.plan?.filter(p => p.status === 'pending' || p.status === 'in_progress').length ?? 0 : 0;
   const status = { verified: run.verified, reviewed: run.reviewed, blockingOpen: run.blockingOpen, checks: run.checksRun, fixLoops: run.fixLoops,
     ...(planOpen ? { planOpen } : {}), ...(run.planSkipped ? { planSkipped: true } : {}), ...(run.disputes.length ? { disputes: run.disputes.length } : {}), ...(run.changed ? {} : { unchanged: true }) };
   const words = [...(run.changed ? [run.verified ? 'a check passed on the final code' : policy.verify === 'off' ? null : run.docsOnly ? 'only documentation changed: no check needed' : 'no check passed on the final code',
     run.reviewed ? (run.blockingOpen ? `review: ${run.blockingOpen} blocking issue(s) still open` : 'review: no blocking issue') : policy.review === 'off' ? null : run.reviewUnavailable ? `review could not run (${run.reviewUnavailableReason})` : 'not reviewed',
     run.planSkipped ? 'code was changed before the required plan existed' : null, planOpen ? `plan: ${planOpen} step(s) not completed` : null] : []),
-    run.disputes.length ? `${run.disputes.length} disagreement(s) between the main agent and a subagent go to the member` : null].filter(Boolean);
+    run.disputes.length ? `${run.disputes.length} disagreement(s) between the main agent and a subagent go to the member` : null, ledgerWords(run)].filter(Boolean);
   await session.sendCustomMessage({ customType: 'agent-watch-process', content: `Process status for this turn: ${run.changed ? 'code changed' : 'no code changed'}; ${words.join('; ') || 'no process step configured'}.`, display: true,
     details: { phase: 'final', outcome: run.outcome, ...status, ...(run.reviewUnavailable ? { reviewUnavailable: run.reviewUnavailableReason } : {}), policy: { verify: policy.verify, review: policy.review },
       ...(configured.lanes && run.lane ? { lane: run.lane, ...(run.laneStats ? { size: run.laneStats } : {}) } : {}) } }, { triggerTurn: false });
@@ -457,6 +461,8 @@ export function processEditTools(session, tools) {
     return { ...tool, execute: async (...args) => {
       const plan = currentPlan(session.session.sessionManager);
       session.run?.beforeEdit(tool.name, plan, session.mainAnswers);
+      // An open premise objection is resolved before files change (ledger.mjs).
+      if (tool.name !== 'bash' || !isReadOnlyCommand(args[1]?.command)) ledgerGuard(session.run, session.mainAnswers);
       // While a required plan is missing, a command that changes files
       // counts as an edit: the code is compared after each command.
       const watch = tool.name === 'bash' && !!session.run?.planMissing(plan) && !session.run.unplannedChange && session.run.startDigest !== null;

package/packages/piagent-core/mcp/mcp-config-layers.js

@@ -44,7 +44,10 @@ export function configPathForScope(scope, options = {}) {
     case "global":
       return path.join(env.XDG_CONFIG_HOME || path.join(home, ".config"), "mcp", "mcp.json");
     case "pi-global":
-      return path.join(env.PI_CODING_AGENT_DIR || path.join(home, ".pi", "agent"), "mcp.json");
+      // Piagent's own Pi home, not the member's personal pi (see extensions/agent-home.js).
+      if (env.PIAGENT_AGENT_DIR) return path.join(env.PIAGENT_AGENT_DIR, "mcp.json");
+      if (env.PI_CODING_AGENT_DIR && path.resolve(env.PI_CODING_AGENT_DIR) !== path.resolve(home, ".pi", "agent")) return path.join(env.PI_CODING_AGENT_DIR, "mcp.json");
+      return path.join(home, ".piagent", "agent", "mcp.json");
     case "project":
       return path.join(projectPath, ".mcp.json");
     case "pi-project":

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.45.0",
+  "version": "1.46.1",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/runtime/managed-failure.mjs

@@ -89,6 +89,14 @@ const CODES = {
   'managed-helper-not-configured': ['tool', 'the company Harness does not enable this subagent'],
   'managed-helper-limit': ['tool', 'this subagent already ran 8 times for this message'],
   'managed-helper-disputed': ['tool', 'this subagent objected to the brief twice for this message; the member decides'],
+  'managed-objection-open': ['tool', 'a helper objected that the brief rests on a wrong premise; decide it with resolve_objection first'],
+  'managed-objection-unknown': ['tool', 'no such objection in this message'],
+  'managed-objection-settled': ['tool', 'this objection is already decided'],
+  'managed-objection-invalid': ['tool', 'a decision names what changed (accepted) or why the objection does not hold (rejected)'],
+  'managed-review-by-harness': ['tool', 'the harness reviews the final patch; the agent does not ask for one'],
+  'managed-review-once': ['tool', 'this change was reviewed already; ask again only after fixing blocking findings'],
+  'managed-copies-invalid': ['tool', 'several helpers of a role run 2 or 3 at a time, at the member\'s request'],
+  'managed-copies-not-asked': ['tool', 'more than one helper of a role runs only when the member asks for it'],
   helper_run_limit_reached: ['tool', 'this subagent already ran 8 times for this message'],
   'managed-helper-cancelled': ['tool', 'the subagent was stopped'],
   'managed-helper-failed': ['failed', 'the subagent ended without an answer'],

package/packages/piagent-webui/extension/piagent-webui.ts

@@ -34,6 +34,7 @@ import { VSCodeHandoff } from "./vscode-handoff.ts";
 import { browserCommand } from "../../piagent-core/runtime/host/browser-opener.mjs";
 import { TerminalSessionAdapter } from "./terminal-session-adapter.ts";
 import { isGatewayRuntimeContext } from "../ownership/gateway-runtime-context.ts";
+import { dormantInPersonalPi } from "../../piagent-core/extensions/agent-home.js";
 
 const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const PLATFORM_ROOT = path.resolve(PACKAGE_ROOT, "../..");
@@ -183,6 +184,7 @@ function readMethod(provider: CoreInspectionProvider, queue: HeldMessageQueue, s
 }
 
 export default function piagentWebUiExtension(pi: ExtensionAPI): void {
+  if (dormantInPersonalPi()) return;
   const runtimeInstanceId = createWebUiExtensionRuntimeInstanceRef();
   let terminalAdapter: TerminalSessionAdapter | null = null;
   const managers = new Map<string, Manager>();

package/packages/piagent-webui/gateway/gateway-service.ts

@@ -53,6 +53,7 @@ import { CompanyRelay, type CompanyConnector } from "./company-relay.ts";
 import { ProviderAuthBroker } from "./provider-auth-broker.ts";
 import { McpAuthBroker } from "./mcp-auth-broker.ts";
 import { AgentStatusFiles } from "./agent-status-files.ts";
+import { agentWatchControlDir, piagentAgentDir } from "../../piagent-core/extensions/agent-home.js";
 import type { ScopedBrokerRouter, RuntimeFactory } from "./session-runtime-factory.ts";
 import { UiPreferencesStore } from "./ui-preferences-store.ts";
 
@@ -249,7 +250,9 @@ export async function startPiagentGateway(options: {
     // Agent Watch reads the member's ~/.pi/agent/status. The dashboard's
     // agentDir is that folder; the company Gateway's is its private session
     // folder under Agent Watch, so it writes to the member's folder instead.
-    statusFiles = new AgentStatusFiles((options.managed ? path.join(os.homedir(), ".pi", "agent", "status", "company") : path.join(state.agentDir, "status", "dashboard")), async () => { const catalog = await readCatalog(); if (catalog.state !== "ready") throw new Error("catalog-not-ready"); return catalog; }, () => Boolean(options.managed)); statusFiles.start();
+    // Piagent's own home serves the member's dashboard; a test or benchmark home keeps its status beside it.
+    const watchRoot = options.managed || state.agentDir === piagentAgentDir() ? agentWatchControlDir() : state.agentDir;
+    statusFiles = new AgentStatusFiles(path.join(watchRoot, "status", options.managed ? "company" : "dashboard"), async () => { const catalog = await readCatalog(); if (catalog.state !== "ready") throw new Error("catalog-not-ready"); return catalog; }, () => Boolean(options.managed)); statusFiles.start();
     const projectFolder = async (projectRef: string) => projects.resolve(projectRef)
       ?? (await runtimes!.listSessions()).find((info) => typeof info.cwd === "string" && projectRefForCwd(key, info.cwd) === projectRef)?.cwd
       ?? (relay ? (await relay.folders()).find((folder) => projectRefForCwd(key, folder) === projectRef) : undefined);

package/packages/piagent-webui/gateway/pi-host.ts

@@ -5,6 +5,7 @@ import path from "node:path";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 import { privateHostRoot } from "../../piagent-core/managed/pi-host.mjs";
+import { agentWatchControlDir } from "../../piagent-core/extensions/agent-home.js";
 
 const require = createRequire(import.meta.url);
 
@@ -58,8 +59,7 @@ export function installedPiHostRoot(): string {
   const home = os.homedir(), hostPackage = path.join("lib", "node_modules", "@earendil-works", "pi-coding-agent");
   let recorded: string | null = null;
   try {
-    const agentDir = process.env.PI_CODING_AGENT_DIR || path.join(home, ".pi", "agent");
-    recorded = JSON.parse(fs.readFileSync(path.join(agentDir, "piagent-runtime.json"), "utf8")).pi_sdk_root ?? null;
+    recorded = JSON.parse(fs.readFileSync(path.join(agentWatchControlDir(home), "piagent-runtime.json"), "utf8")).pi_sdk_root ?? null;
   } catch { /* no record yet */ }
   // npm's default Windows prefixes (%APPDATA%\npm, or beside node.exe) have no lib folder.
   const appData = process.env.APPDATA ?? path.join(home, "AppData", "Roaming");

package/packages/piagent-webui/ownership/profile-state.ts

@@ -47,8 +47,17 @@ function shortControlSocket(agentDir: string): string {
   return path.join(socketRoot, `${digest}.sock`);
 }
 
+// Piagent's own Pi home (~/.piagent/agent), never the member's personal pi.
+// Same rule as piagent-core/extensions/agent-home.js, which this layer cannot import.
+function defaultAgentDir(): string {
+  const own = process.env.PIAGENT_AGENT_DIR?.trim(), configured = process.env.PI_CODING_AGENT_DIR?.trim();
+  if (own) return own;
+  if (configured && path.resolve(configured) !== path.resolve(os.homedir(), ".pi", "agent")) return configured;
+  return path.join(os.homedir(), ".piagent", "agent");
+}
+
 export function gatewayProfileState(agentDirInput?: string): GatewayProfileState {
-  const agentDir = path.resolve(agentDirInput || process.env.PI_CODING_AGENT_DIR || path.join(os.homedir(), ".pi", "agent"));
+  const agentDir = path.resolve(agentDirInput || defaultAgentDir());
   fs.mkdirSync(agentDir, { recursive: true, mode: 0o700 });
   const agentStat = fs.lstatSync(agentDir);
   if (!agentStat.isDirectory() || agentStat.isSymbolicLink()

package/packages/piagent-webui/server/benchmark-release-monitor.ts

@@ -10,6 +10,7 @@ import { assertBenchmarkLedgerBinding, inspectBenchmarkLedger, validateBenchmark
 import { completedBenchmarkRecord } from "../../piagent-core/benchmark/benchmark-record-validation.js";
 import { benchmarkGitEnvironment } from "../../piagent-core/benchmark/benchmark-runtime.js";
 import { redactSensitiveText } from "../../piagent-core/extensions/redaction-core.js";
+import { piagentAgentDir } from "../../piagent-core/extensions/agent-home.js";
 
 const MAX_RUNS = 20, MAX_DIRECTORIES = 100, MAX_DIRECTORY_ENTRIES = 5_000, MAX_JSON_BYTES = 32 * 1024 * 1024;
 type Identity = { projectRef: string; runtimeInstanceId: string; sessionRef: string; taskId: string | null; taskRunId: string | null;
@@ -210,7 +211,7 @@ function releaseReadiness(cwd: string, file: string, repo: ReturnType<typeof rep
 export function projectBenchmarkReleaseMonitor(input: { cwd: string; identity: Identity; generatedAt?: string; benchmarkRoot?: string; releaseReportPath?: string }) {
   const generatedAt = input.generatedAt ?? new Date().toISOString();
   try {
-    const repo = repository(input.cwd), root = input.benchmarkRoot ?? path.join(process.env.PI_CODING_AGENT_DIR || path.join(os.homedir(), ".pi", "agent"), "benchmarks", "piagent");
+    const repo = repository(input.cwd), root = input.benchmarkRoot ?? path.join(piagentAgentDir(), "benchmarks", "piagent");
     const releasePath = input.releaseReportPath ?? path.join(input.cwd, "plans", "codex-first-product", "evidence", "p7-local-readiness", "report.json");
     const benchmark = benchmarkRuns(input.cwd, root, repo), release = releaseReadiness(input.cwd, releasePath, repo);
     const revision = `release-monitor.${createHash("sha256").update(JSON.stringify({ benchmark, release })).digest("hex")}`;

package/scripts/benchmark-runner-support.mjs

@@ -14,6 +14,7 @@ import { acquireBenchmarkRunLock } from "../packages/piagent-core/benchmark/benc
 import { recoverBenchmarkObservationCheckpoints } from "../packages/piagent-core/benchmark/benchmark-resume-recovery.js";
 import { benchmarkSurfaceLabel } from "../packages/piagent-core/benchmark/benchmark-core.js";
 import { codexModelName, codexThinkingEffort } from "../packages/piagent-core/benchmark/benchmark-codex.js";
+import { piagentAgentDir } from "../packages/piagent-core/extensions/agent-home.js";
 
 export function fail(message, code = 2) {
   const error = new Error(message);
@@ -96,7 +97,7 @@ export function registeredBenchmarkCustodyRoot(runRoot) {
 
 export function defaultOutputRoot(bootstrapMetadata) {
   if (bootstrapMetadata?.defaultOutputRoot) return bootstrapMetadata.defaultOutputRoot;
-  const agentRoot = process.env.PI_CODING_AGENT_DIR || path.join(os.homedir(), ".pi", "agent");
+  const agentRoot = piagentAgentDir();
   return path.join(agentRoot, "benchmarks", "piagent");
 }
 

package/scripts/company-terminal.mjs

@@ -14,6 +14,7 @@ import { parseFailure } from '../packages/piagent-core/runtime/managed-failure.m
 import { checkpointsOf } from '../packages/piagent-core/managed/checkpoints.mjs';
 import { bypassAllowed, effectivePermission } from '../packages/piagent-core/managed/permission.mjs';
 import { memoryOn } from '../packages/piagent-core/managed/memory.mjs';
+import { currentPlan, unfinished } from '../packages/piagent-core/managed/workflow.mjs';
 import { companyFailureText } from '../packages/piagent-webui/shared/company-copy.ts';
 import { headlineText, outcomeText, processItems } from '../packages/piagent-webui/shared/process-copy.ts';
 import { turnEndCopy, turnEndOf } from '../packages/piagent-webui/shared/turn-end.ts';
@@ -146,6 +147,18 @@ export function planLines(plan) {
     ...steps.map((p) => `  ${mark[p.status] ?? '☐'} ${p.step}${p.status === 'in_progress' ? '  ← đang làm' : p.status === 'deferred' ? '  (để sau)' : ''}`)];
 }
 
+// The panel above the input while a turn works: the checklist while a step
+// is open, and each subagent running now with its job and latest step.
+export function planWidget(plan) {
+  return unfinished(plan) ? planLines(plan.plan) : undefined;
+}
+export function helperLines(helpers) {
+  const list = Array.isArray(helpers) ? helpers.filter((h) => typeof h?.role === 'string') : [];
+  if (!list.length) return undefined;
+  const many = (role) => list.filter((h) => h.role === role).length > 1;
+  return [`Subagent đang chạy · ${list.length}`, ...list.map((h) => `  ⟳ ${h.role}${many(h.role) ? ` ${h.slot ?? 1}` : ''}${h.job ? ` · ${String(h.job).slice(0, 60)}` : ''}${h.step ? ` — ${String(h.step).slice(0, 70)}` : ''}`)];
+}
+
 // A harness note's details, in the shape the shared copy reads.
 export function processInput(details) {
   if (!details || typeof details !== 'object' || typeof details.phase !== 'string') return null;
@@ -402,7 +415,12 @@ export function companyTerminalExtension({ managed, packageRoot, sdkRoot, bindin
       const showBranch = async () => { try { const branch = await branchOf(managed()?.cwd ?? ctx.cwd); ctx.ui?.setStatus?.('agent-watch-branch', branch ? `⎇ ${branch}` : undefined); } catch { /* closed meanwhile */ } };
       ctx.ui?.setWorkingMessage?.(WORKING);
       void showBranch();
+      // The checklist and the subagents working now stay above the input (setWidget).
+      const showPlan = () => ctx.ui?.setWidget?.('agent-watch-plan', planWidget(currentPlan(session.sessionManager)));
+      showPlan();
       session.subscribe((event) => {
+        if (event?.type === 'tool_execution_end' && event.toolName === 'update_plan' || event?.type === 'agent_end') showPlan();
+        if (event?.type === 'managed_helper_state') ctx.ui?.setWidget?.('agent-watch-helpers', helperLines(event.helpers));
         if (event?.type === 'managed_helpers') ctx.ui?.setStatus?.('agent-watch-helpers', event.active ? `Subagent ${event.active}/${event.maximum}` : undefined);
         if (event?.type === 'managed_project_warning') ctx.ui?.notify?.(projectWarningText(event.warnings, event.team, LOCALE), 'warning');
         const end = event?.type === 'managed_turn_end' ? turnEndOf(event.end) : null;
@@ -413,7 +431,7 @@ export function companyTerminalExtension({ managed, packageRoot, sdkRoot, bindin
       });
     });
     pi.registerMessageRenderer('agent-watch-review-status', (_message, _options, theme) =>
-      box('Review đã cũ: code đổi sau khi review. Cần review lại cho thay đổi hiện tại.', theme, 'warning'));
+      box('Review đã cũ: code đổi sau khi review. Chỉ cần review lại khi đã sửa lỗi blocking.', theme, 'warning'));
     pi.registerMessageRenderer('agent-watch-helper-receipt', (message, _options, theme) =>
       box(String(message.content ?? '').replace(/(\d[\d,]*) tokens/, '$1 token').replace('review is stale', 'review đã cũ'), theme, 'dim'));
 

package/scripts/dashboard-update-job.mjs

@@ -59,8 +59,10 @@ if (installed !== to) finish("failed", { reason: "update-version-mismatch", ...(
 // the launcher needs the binding imported again in Agent Watch.
 let bindingChanged = false;
 try {
-  const agentDir = process.env.PI_CODING_AGENT_DIR?.trim() || path.join(home, ".pi", "agent");
-  const binding = JSON.parse(fs.readFileSync(path.join(agentDir, "agent-watch-managed.json"), "utf8"));
+  // Agent Watch keeps the binding in the personal Pi folder; a test or custom home may hold its own.
+  const homes = [process.env.PI_CODING_AGENT_DIR?.trim(), path.join(home, ".pi", "agent")].filter(Boolean);
+  const file = homes.map((dir) => path.join(dir, "agent-watch-managed.json")).find((candidate) => fs.existsSync(candidate));
+  const binding = JSON.parse(fs.readFileSync(file, "utf8"));
   if (typeof binding?.entrypoint === "string" && typeof binding?.entrypoint_sha256 === "string")
     bindingChanged = crypto.createHash("sha256").update(fs.readFileSync(binding.entrypoint)).digest("hex") !== binding.entrypoint_sha256;
 } catch { /* no company binding on this machine */ }